Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2278873

Summary: When pcs restarts ceph-nfs using it’s newly generated config causes missing keyrings
Product: Red Hat OpenStack Reporter: Kenny Tordeurs <ktordeur>
Component: cephAssignee: Giulio Fidente <gfidente>
Status: CLOSED DUPLICATE QA Contact: Alfredo <alfrgarc>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 16.2 (Train)CC: alfrgarc, gfidente, jdurgin, jelle.hoylaerts.ext, johfulto, lhh, madgupta, mhicks
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2024-05-08 14:05:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Kenny Tordeurs 2024-05-03 12:13:41 UTC
Description of problem:
Upgrading NFS Ganesha when moving from Red Hat Ceph Storage 5 to 6

When following the upgrade guide for ceph.

At the point when pcs restarts ceph-nfs using it’s newly generated config you end up again in an issue that certain keyrings are missing:
7f565a11f200 -1 auth: unable to find a keyring on /var/lib/ceph/radosgw/ceph-rgw.openstack/keyring: (2) No such file or directory
7f565a11f200 -1 AuthRegistry(0x5616d41c4ee0) no keyring found at /var/lib/ceph/radosgw/ceph-rgw.openstack/keyring, disabling cephx
7f565a11f200 -1 auth: unable to find a keyring on /var/lib/ceph/radosgw/ceph-rgw.openstack/keyring: (2) No such file or directory
7f565a11f200 -1 AuthRegistry(0x7ffe02ad13a0) no keyring found at /var/lib/ceph/radosgw/ceph-rgw.openstack/keyring, disabling cephx
7f5647fff640 -1 monclient(hunting): handle_auth_bad_method server allowed_methods [2] but i only support [1]
7f564ca83640 -1 monclient(hunting): handle_auth_bad_method server allowed_methods [2] but i only support [1]
7f565a11f200 -1 monclient: authenticate NOTE: no keyring found; disabled cephx authentication

Due to this of course again the container can’t start

Version-Release number of selected component (if applicable):
OSP 16.2

How reproducible:
100%

Steps to Reproduce:
1. Upgrade ceph 5 to 6
2.
3.

Actual results:
container does not start

Expected results:
container to start and no missing keyrings

Additional info:
Director deployed ceph

Comment 1 John Fulton 2024-05-06 12:09:20 UTC
I see it looking in /var/lib/ceph/ instead of /etc/ceph.

This can happen if you do not pass this parameter

  CephConfigPath: "/etc/ceph"

As described in 5.1 step 9

  https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/17.1/html-single/framework_for_upgrades_16.2_to_17.1/index

Can you try again with that parameter passed?

Also, on the controller node can you see the missing key on the controller node in /etc/ceph?

Comment 2 Kenny Tordeurs 2024-05-06 13:10:25 UTC
That is configured in:

(undercloud) [stack@openstack ~]$ cat osp17.1_upgrade/ceph-params.yaml
±±±
parameter_defaults:

  CephSpecFqdn: false

  CephConfigPath: "/etc/ceph"

  CephAnsibleRepo: "rhceph-5-tools-for-rhel-8-x86_64-rpms"

  DeployedCeph: true
±±±

Comment 3 John Fulton 2024-05-06 13:16:26 UTC
(In reply to Kenny Tordeurs from comment #2)
> That is configured in:
> 
> (undercloud) [stack@openstack ~]$ cat osp17.1_upgrade/ceph-params.yaml
> ±±±
> parameter_defaults:
> 
>   CephSpecFqdn: false
> 
>   CephConfigPath: "/etc/ceph"
> 
>   CephAnsibleRepo: "rhceph-5-tools-for-rhel-8-x86_64-rpms"
> 
>   DeployedCeph: true
> ±±±

Please share the `opentack overcloud ` ... `-e osp17.1_upgrade/ceph-params.yaml` you are using.


Also, as I asked previously, on the controller node can you see the missing key on the controller node in /etc/ceph?

Comment 4 John Fulton 2024-05-06 13:35:52 UTC
> Please share the `opentack overcloud ` ... `-e osp17.1_upgrade/ceph-params.yaml` you are using.

I ask for the above because, if you have something like

-e osp17.1_upgrade/ceph-params.yaml -e /usr/share/...

Then the default in /usr/share will override the override in ceph-params.yaml

If we confirm the above and see that the keys are actually in /etc/ceph on the controller, then changing the argument order should be sufficient to address the issue.

Comment 5 Kenny Tordeurs 2024-05-07 14:10:09 UTC
These are the contents of the /etc/ceph/ directory but as you can see the naming of the keyrings do not match

$ ll /etc/ceph/
~~~
total 44
-rwxr-xr-x. 1 ceph ceph   0 May  2 10:35 cephadm.priv
-rwxr-xr-x. 1 ceph ceph   0 May  2 10:35 cephadm.pub
-rw-------. 1 ceph ceph 151 May  2 10:35 ceph.client.admin.keyring
-rw-------. 1 ceph ceph 131 May  2 10:35 ceph.client.crash.keyring
-rw-------. 1 ceph ceph 153 May  2 10:35 ceph.client.manila.keyring
-rw-r--r--. 1 ceph ceph 231 May  2 10:35 ceph.client.openstack.keyring
-rw-r--r--. 1 ceph ceph 138 May  2 10:35 ceph.client.radosgw.keyring
-rw-
~~~

~~~
7f565a11f200 -1 auth: unable to find a keyring on /var/lib/ceph/radosgw/ceph-rgw.openstack/keyring: (2) No such file or directory
7f565a11f200 -1 AuthRegistry(0x5616d41c4ee0) no keyring found at /var/lib/ceph/radosgw/ceph-rgw.openstack/keyring, disabling cephx
7f565a11f200 -1 auth: unable to find a keyring on /var/lib/ceph/radosgw/ceph-rgw.openstack/keyring: (2) No such file or directory
7f565a11f200 -1 AuthRegistry(0x7ffe02ad13a0) no keyring found at /var/lib/ceph/radosgw/ceph-rgw.openstack/keyring, disabling cephx
7f5647fff640 -1 monclient(hunting): handle_auth_bad_method server allowed_methods [2] but i only support [1]
7f564ca83640 -1 monclient(hunting): handle_auth_bad_method server allowed_methods [2] but i only support [1]
7f565a11f200 -1 monclient: authenticate NOTE: no keyring found; disabled cephx authentication
~~~

Comment 6 Kenny Tordeurs 2024-05-07 14:12:09 UTC
Sharing the full command:

openstack overcloud upgrade prepare --yes \
--timeout 460 \
--templates /usr/share/openstack-tripleo-heat-templates \
--stack $CLUSTER \
-r ~/templates/roles_data.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/services/neutron-ovs.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/services/neutron-sriov.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/services/neutron-ovs-dpdk.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/cephadm/cephadm.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/cephadm/ceph-dashboard.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/cephadm/ceph-mds.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/cinder-backup.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/services/octavia.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-dns.yaml \
-e ~/common_templates/aide.yaml \
-e ~/common_templates/ceph-config.yaml \
-e ~/common_templates/extraconfig-environment.yaml \
-e ~/templates/extraconfig-environment.yaml \
-e ~/common_templates/inject-trust-anchor-hiera.yaml \
-e ~/common_templates/keystone_domain_specific_ldap_backend.yaml \
-e ~/common_templates/network-environment-overrides.yaml \
-e ~/templates/network-environment-overrides.yaml \
-e ~/common_templates/nova-environment-overrides.yaml \
-e ~/templates/nova-environment-overrides.yaml \
-e ~/common_templates/octavia-environment.yaml \
-e ~/common_templates/pci_passthru_compute.yaml \
-e ~/common_templates/pci_passthru_controller.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/services/barbican.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/barbican-backend-simple-crypto.yaml \
-e ~/common_templates/configure-barbican.yaml \
-e ~/common_templates/security.yaml \
-e ~/templates/cloudname.yaml \
-e ~/templates/enable-tls.yaml \
-e ~/templates/fencing.yaml \
-e ~/templates/rhsm.yaml \
-e ~/templates/storage-config.yaml \
-e ~/templates/upgrades-environment.yaml \
-e ~/osp17.1_upgrade/ceph-params.yaml \
-e ~/overcloud-deploy/$CLUSTER/$CLUSTER-network-environment.yaml \
-e ~/overcloud_adopt/baremetal-deployment.yaml \
-e ~/overcloud_adopt/generated-networks-deployed.yaml \
-e ~/overcloud_adopt/generated-vip-deployed.yaml \
-e /usr/share/openstack-tripleo-heat-templates/environments/nova-hw-machine-type-upgrade.yaml \
-e ~/osp17.1_upgrade/system_upgrade.yaml \
-e ~/templates/containers-prepare-parameter.yaml \
--debug
2>&1 | tee $LOGFILE

Comment 10 John Fulton 2024-05-08 14:05:08 UTC

*** This bug has been marked as a duplicate of bug 2278832 ***